Commit 81a0c8bc authored by Kees Cook's avatar Kees Cook

selftests/seccomp: Improve calibration loop

The seccomp benchmark calibration loop did not need to take so long.
Instead, use a simple 1 second timeout and multiply up to target. It
does not need to be accurate.
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
parent bc32c9c8
...@@ -18,9 +18,9 @@ ...@@ -18,9 +18,9 @@
unsigned long long timing(clockid_t clk_id, unsigned long long samples) unsigned long long timing(clockid_t clk_id, unsigned long long samples)
{ {
pid_t pid, ret;
unsigned long long i;
struct timespec start, finish; struct timespec start, finish;
unsigned long long i;
pid_t pid, ret;
pid = getpid(); pid = getpid();
assert(clock_gettime(clk_id, &start) == 0); assert(clock_gettime(clk_id, &start) == 0);
...@@ -31,30 +31,43 @@ unsigned long long timing(clockid_t clk_id, unsigned long long samples) ...@@ -31,30 +31,43 @@ unsigned long long timing(clockid_t clk_id, unsigned long long samples)
assert(clock_gettime(clk_id, &finish) == 0); assert(clock_gettime(clk_id, &finish) == 0);
i = finish.tv_sec - start.tv_sec; i = finish.tv_sec - start.tv_sec;
i *= 1000000000; i *= 1000000000ULL;
i += finish.tv_nsec - start.tv_nsec; i += finish.tv_nsec - start.tv_nsec;
printf("%lu.%09lu - %lu.%09lu = %llu\n", printf("%lu.%09lu - %lu.%09lu = %llu (%.1fs)\n",
finish.tv_sec, finish.tv_nsec, finish.tv_sec, finish.tv_nsec,
start.tv_sec, start.tv_nsec, start.tv_sec, start.tv_nsec,
i); i, (double)i / 1000000000.0);
return i; return i;
} }
unsigned long long calibrate(void) unsigned long long calibrate(void)
{ {
unsigned long long i; struct timespec start, finish;
unsigned long long i, samples, step = 9973;
printf("Calibrating reasonable sample size...\n"); pid_t pid, ret;
int seconds = 15;
for (i = 5; ; i++) { printf("Calibrating sample size for %d seconds worth of syscalls ...\n", seconds);
unsigned long long samples = 1 << i;
/* Find something that takes more than 5 seconds to run. */ samples = 0;
if (timing(CLOCK_REALTIME, samples) / 1000000000ULL > 5) pid = getpid();
return samples; assert(clock_gettime(CLOCK_MONOTONIC, &start) == 0);
} do {
for (i = 0; i < step; i++) {
ret = syscall(__NR_getpid);
assert(pid == ret);
}
assert(clock_gettime(CLOCK_MONOTONIC, &finish) == 0);
samples += step;
i = finish.tv_sec - start.tv_sec;
i *= 1000000000ULL;
i += finish.tv_nsec - start.tv_nsec;
} while (i < 1000000000ULL);
return samples * seconds;
} }
int main(int argc, char *argv[]) int main(int argc, char *argv[])
...@@ -70,15 +83,16 @@ int main(int argc, char *argv[]) ...@@ -70,15 +83,16 @@ int main(int argc, char *argv[])
unsigned long long samples; unsigned long long samples;
unsigned long long native, filter1, filter2; unsigned long long native, filter1, filter2;
printf("Current BPF sysctl settings:\n");
system("sysctl net.core.bpf_jit_enable");
system("sysctl net.core.bpf_jit_harden");
if (argc > 1) if (argc > 1)
samples = strtoull(argv[1], NULL, 0); samples = strtoull(argv[1], NULL, 0);
else else
samples = calibrate(); samples = calibrate();
printf("Current BPF sysctl settings:\n"); printf("Benchmarking %llu syscalls...\n", samples);
system("sysctl net.core.bpf_jit_enable");
system("sysctl net.core.bpf_jit_harden");
printf("Benchmarking %llu samples...\n", samples);
/* Native call */ /* Native call */
native = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples; native = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment